NordVPN employs advanced security infrastructure to render leaked combolists ineffective:

Turning on MFA ensures that even if a hacker acquires your exact email and password from a combolist, they cannot log in without a secondary verification code sent to your authenticator app. Monitor HaveIBeenPwned

Link an app like Google Authenticator, Microsoft Authenticator, or Authy. Step 3: Switch to Passkeys